Bug 153303 - www-apps/wordpress-2.0.5 version bump
|
Bug#:
153303
|
Product: Gentoo Linux
|
Version: unspecified
|
Platform: All
|
|
OS/Version: Other
|
Status: RESOLVED
|
Severity: normal
|
Priority: P2
|
|
Resolution: FIXED
|
Assigned To: security@gentoo.org
|
Reported By: jesus.de.santos@gmail.com
|
|
Component: Ebuilds
|
|
|
URL:
|
|
Summary: www-apps/wordpress-2.0.5 version bump
|
|
Keywords:
|
|
Status Whiteboard: B3? [glsa] frilled
|
|
Opened: 2006-10-29 08:15 0000
|
"The latest in our venerable 2.0 series, which now counts over 1.2 million
downloads, is available for download immediately, and we suggest everyone
upgrade as this includes security fixes."
Re-assigning to security@g.o
Accepting bug; should be at least 3 sec-related fixes, though.
Rating B3 for now, mostly for the unserialize() problem - feel free to comment.
(In reply to comment #5)
> Accepting bug; should be at least 3 sec-related fixes, though.
>
> Rating B3 for now, mostly for the unserialize() problem - feel free to comment.
>
The fix for this is also security related -
http://trac.wordpress.org/ticket/3142
Although not vulnerable by default as it requires user registration to be
enabled you could spy out the metadata of other users (email, etc) including
the admin account.
Two days later and wordpress-2.0.5.tar.gz still cannot be found in the mirrors
when doing ebuild digest.
May be there is something i am doing wrong...
(In reply to comment #7)
> Two days later and wordpress-2.0.5.tar.gz still cannot be found in the mirrors
> when doing ebuild digest.
>
> May be there is something i am doing wrong...
>
Yes
wordpress-2.0.5.tar.gz will only reach the mirrors once the new ebuild is
committed to the tree.
It upgraded nicely from previous version.
----
Portage 2.1.1-r1 (default-linux/x86/2006.0, gcc-4.1.1, glibc-2.4-r3,
2.6.17-gent oo-r8 i686)
=================================================================
System uname: 2.6.17-gentoo-r8 i686 Intel(R) Celeron(R) CPU 2.40GHz
Gentoo Base System version 1.12.5
Last Sync: Wed, 01 Nov 2006 01:50:01 +0000
app-admin/eselect-compiler: [Not Present]
dev-java/java-config: [Not Present]
dev-lang/python: 2.3.5-r2, 2.4.3-r4
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache: [Not Present]
dev-util/confcache: [Not Present]
sys-apps/sandbox: 1.2.17
sys-devel/autoconf: 2.13, 2.59-r7
sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils: 2.16.1-r3
sys-devel/gcc-config: 1.3.13-r3
sys-devel/libtool: 1.5.22
virtual/os-headers: 2.6.17-r1
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O3 -pipe -march=pentium4 -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/NX/etc /usr/NX/home /usr/share/X11/xkb
/usr/share/logw atch
/var/www/localhost/htdocs/cacti/include"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/terminfo"
CXXFLAGS="-O3 -pipe -march=pentium4 -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig collision-protect distlocks metadata-transfer sandbox
sfper ms strict"
GENTOO_MIRRORS="http://ftp.belnet.be/mirror/rsync.gentoo.org/gentoo/
http://linu v.uv.es/mirror/gentoo/
http://ftp-stud.fht-esslingen.de/pub/Mirrors/gentoo/"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after
--stats --timeout=180 --exclude='/d istfiles'
--exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="x86 X acpi alsa apache2 berkdb bitmap-fonts bzip2 cli cracklib crypt
dlload er dri eds elibc_glibc emboss encode
fam foomaticdb gdbm gif gnome gstreamer gtk
gtk2 iconv imlib input_devices_keyboard input_devices_mouse isdnlog jpeg kernel
_linux libg++ libwww mad mikmod mmx motif mp3
mpeg ncurses nls nptl nptlonly ogg pam pcre
perl png pppd python qt3 qt4 quicktime readline reflection samba sdl s
ession snmp spl sse sse2 ssl svg tiff truetype
truetype-fonts type1-fonts udev u sb
userland_GNU video_cards_fglrx vorbis xml xorg zlib"
Unset: CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS,
LINGU AS, PORTAGE_RSYNC_EXTRA_OPTS
Anything preventing this from hitting cvs?
Time. I just committed it now.
Heh, ok .-)
Arches, please test & mark stable.
I put the tarball on the distfiles-local mirror. It will take a while to
propagate to the other mirrors.
www-apps/wordpress-2.0.5 USE="-vhosts"
1. emerges on x86
2. passes collision test
3. works
Portage 2.1.1-r1 (default-linux/x86/2006.1/desktop, gcc-4.1.1, glibc-2.4-r3,
2.6.17.13 i686)
=================================================================
System uname: 2.6.17.13 i686 AMD Athlon(TM) XP1800+
Gentoo Base System version 1.12.6
Last Sync: Tue, 07 Nov 2006 17:50:01 +0000
ccache version 2.3 [enabled]
app-admin/eselect-compiler: [Not Present]
dev-java/java-config: 1.3.7, 2.0.30
dev-lang/python: 2.3.5-r3, 2.4.3-r4
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache: 2.3
dev-util/confcache: [Not Present]
sys-apps/sandbox: 1.2.17
sys-devel/autoconf: 2.13, 2.60
sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils: 2.16.1-r3
sys-devel/gcc-config: 1.3.13-r4
sys-devel/libtool: 1.5.22
virtual/os-headers: 2.6.17-r1
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=i686 -fomit-frame-pointer -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config
/usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/
/usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/
/usr/share/texmf/xdvi/"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf
/etc/java-config/vms/ /etc/revdep-rebuild /etc/terminfo"
CXXFLAGS="-O2 -march=i686 -fomit-frame-pointer -pipe"
DISTDIR="/usr/portage/distfiles"
EMERGE_DEFAULT_OPTS="--nospinner"
FEATURES="autoconfig ccache collision-protect distlocks fixpackages
metadata-transfer parallel-fetch sandbox sfperms strict test userfetch userpriv
usersandbox"
GENTOO_MIRRORS="http://mirror.switch.ch/mirror/gentoo/ http://gentoo.inode.at/"
LANG="en_GB.utf8"
LINGUAS="en de en_GB"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage/normal"
SYNC="rsync://192.168.2.1/gentoo-portage"
USE="x86 3dnow 3dnowext X a52 aac acpi alsa apache2 bash-completion berkdb
bitmap-fonts bzip2 cairo cdr cli cracklib crypt css cups dbus divx4linux
dlloader dri dts dvd dvdr dvdread elibc_glibc emboss exif fam ffmpeg firefox
font-server fortran gdbm gif gnome gphoto2 gpm gstreamer gtk gtk2 gtkhtml hal
iconv input_devices_keyboard input_devices_mouse ipv6 isdnlog java jpeg kde
kernel_linux ldap libclamav libg++ linguas_de linguas_en linguas_en_GB
logitech-mouse mad mikmod mmx mmxext mono mozcalendar mozdevelop mozsvg mp3
mpeg ncurses network nls nptl nptlonly nvidia oav ogg opengl oss pam pcre perl
png ppds pppd python qt qt3 qt4 quicktime readline reflection samba sdl
seamonkey session spell spl ssl tcltk tcpd test tetex tiff truetype
truetype-fonts type1-fonts udev unicode usb userland_GNU vcd video_cards_none
video_cards_nv vorbis win32codecs xine xinerama xml xorg xorg-x11 xprint xv xvg
xvid zlib"
Unset: CTARGET, INSTALL_MASK, LC_ALL, LDFLAGS, MAKEOPTS,
PORTAGE_RSYNC_EXTRA_OPTS
Hm, somewhere is a dep on net-www/apache missing. On a fresh stage3,
emerge --onlydeps www-apps/wordpress
ACCEPT_KEYWORDS="~amd64" emerge "=www-apps/wordpress-2.0.5"
yields:
* vhosts USE flag not set - auto-installing using webapp-config
* This is an installation
* wordpress-2.0.5 is not installed - using install mode
* Running //usr/sbin/webapp-config -I -h localhost -u root -d /wordpress
wordpress 2.0.5
* Fatal error: Your configuration file sets the server type "Apache"
* Fatal error: but the corresponding package does not seem to be installed!
* Fatal error: Please "emerge >=net-www/apache-1.3" or correct your settings.
* Fatal error(s) - aborting
Besides that, it works. Stable on amd64.
Hm, I'd say you need to configure your webapp-config. At least I hope WordPress
runs on others httpds like lightttpd, too ...
Per Stuart, this is a webapp-config bug. It should not be checking to see if a
specific web server is installed, or not.
Stable for HPPA. All done. Sorry for the loooong wait.
Thanks. SecTeam, review draft please.
